Collective Defense in Cybersecurity: How Regulations Shape Your Supply Chain Strategy

In today's interconnected global economy, supply chain security has become a critical concern for businesses and governments alike. Supply chains are often large and complex. Effectively securing the supply chain can be hard because vulnerabilities can be inherent or introduced and exploited at any point in the supply chain. Despite these risks, many companies lose sight of their supply chains. In fact, according to the 2023 Security Breaches Survey, very few UK businesses set minimum security standards for their suppliers. With the growing complexity and vulnerability of supply chains, regulations, and frameworks play an increasingly crucial role in shaping strategies to ensure the security and resilience of these networks.

Introducing DORA

The Digital Operational Resilience Act (DORA) aims to strengthen the operational resilience of the EU’s financial sector against cyber threats and incidents and ensure the continuity of critical financial services. The Act’s goal is to enhance the ability of financial entities to prevent, detect, respond to, and recover from cyberattacks and IT disruptions. It aims to:

• Enhance Cybersecurity Standards : DORA mandates higher cybersecurity standards for financial institutions, including banks, stock exchanges, trading platforms, and payment service providers.

• Ensure Incident Reporting and Cooperation : Financial services firms must promptly report cyber incidents to relevant authorities and cooperate with them to mitigate their impact.

• Improve Third-Party Risk Management : The Act highlights the importance of managing cybersecurity risks associated with third-party service providers and requires financial organizations to assess and monitor their vendor's security practices.

• Implement Resilience Testing and Planning : These organizations must conduct regular cybersecurity resilience tests and develop robust incident response and recovery plans to ensure continuity of services should a security event occur.

DORA's Impact on Supply Chain Security

Supply chain security is critical in the modern banking landscape for several reasons. The integration of banking APIs, the emergence of neo-banks leveraging open-source software, AI, and automation, and the dependence on complex networks of ICT suppliers introduce vulnerabilities that extend beyond the direct control of banking entities.

These dependencies create potential avenues for cyber threats and data breaches, posing risks to the confidentiality, integrity, and availability of sensitive financial data. Banks are obligated to exercise stringent control and mitigation measures to counteract these threats before they escalate into existential risks.

DORA emerges as a critical regulatory framework addressing these supply chain risks. DORA mandates strict cybersecurity standards and risk management protocols for financial institutions and their third-party providers. By promoting comprehensive ICT (Information and Communication Technology) risk assessments, incident reporting, and penetration testing, DORA compels organizations to fortify their supply chains. This fosters greater transparency and proactive risk mitigation, strengthening the overall resilience of the financial sector.

To outpace evolving cyber threats, the banking and finance sector must also embrace intelligence sharing. This enables timely alerts on emerging attack vectors, aiding in proactive threat detection and bolstering response capabilities.

DORA Complements Other Regulations

In addition to DORA, there are relevant regulations and standards that companies need to bear in mind. Firstly, Network and Information Systems Directive 2 (NIS2) focuses on enhancing the cybersecurity resilience of operators of essential services such as the banking sector. Then, there’s the Payment Card Industry Data Security Standard (PCI DSS 4.0), which sets out security measures for organizations that handle payment card data to prevent data breaches and protect cardholder information.

While the NIS2 directive establishes broad cybersecurity standards for critical sectors, DORA specifically targets the financial sector. DORA's in-depth focus on operational resilience and ICT risk management complements NIS2 by providing tailored guidance and stricter requirements for financial institutions.

Similarly, PCI DSS and DORA converge in safeguarding sensitive data and preventing breaches, introducing similar requirements for third-party risk and incident response. There is also alignment between GDPR and DORA as they prioritize the security and integrity of data and the rights of data subjects.

Managing Security Across Multiple Suppliers

These standards are helpful because managing security across the supply chain presents several challenges. Each partner may be subject to different regulatory requirements, depending on their industry, geographic location, and the nature of services provided.

Organizations may also face resource constraints, as conducting thorough risk assessments, performing due diligence, and monitoring vendor compliance can be resource-intensive tasks, particularly for organizations with extensive supplier networks.

Ensuring that new partners meet security requirements and that departing ones appropriately transition responsibilities and data comes with logistical and security challenges, too.

Collective Defense as a Solution

Collective defense is emerging as a highly effective approach to bolstering supply chain security. This is a collaborative outlook wherein organizations join forces to detect, prevent, and respond to evolving threats.

It requires sharing threat intelligence, best practices, and resources among stakeholders to bolster their collective cybersecurity posture. By pooling industry knowledge and capabilities, organizations can identify and mitigate cyber risks more rapidly and effectively and improve the overall resilience of the ecosystem.

Several industry and government-led initiatives are in place to promote collective defense. For instance, the EU Cyber Solidarity Act aims to strengthen cooperation among EU member states in responding to cyberattacks and managing cybersecurity risks. It encourages information sharing, joint exercises, and capacity-building initiatives to enhance European cybersecurity resilience.

Collective defense fuels early threat detection, improving situational awareness for better risk management and enhancing response capabilities through coordinated efforts. This approach also promotes cost efficiency by sharing resources and leveraging economies of scale, which is particularly beneficial for smaller entities with limited budgets.

Building Effective Collective Defense Mechanisms

There are several best practices to consider when building effective collective defense mechanisms. Establishing trust among stakeholders and ensuring shared information remains confidential is critical. Clear policies, legal frameworks, and technical measures must be implemented to protect sensitive data and participants' interests.

Collective defense mechanisms must be interoperable and compatible with existing cybersecurity tools and processes. Standardizing formats, protocols, and APIs helps with seamless integration and interoperability among stakeholders.

Division of labor, leveraging automation, and sharing the burden of responsibility can also ensure sustainability and long-term success. Also, the cybersecurity landscape is dynamic, with new threats and vulnerabilities emerging regularly, so any collective defense approach must adapt continuously to remain effective against evolving threats. Regular assessments are also crucial for maintaining relevance and effectiveness.

Active Engagement is Critical

In the face of evolving regulations and heightened cyber risks, continually reassessing risk management strategies is vital. DORA and other regulations call for a renewed focus on cybersecurity and operational resilience. Collective defense through active engagement in industry-wide collaboration initiatives has become essential to strengthening supply chain security and protecting the broader financial ecosystem.

To learn more about how Cyware can assist you in automating threat intelligence operations, schedule a free demo!